Packet beat - index created monthly

[derekmizak (DerekM)]

I want to have packetbeat index created monthly.
In pcketbeat.yml I have chnaged configuration option as follow:

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
 
  hosts: ["localhost:9200"]
  output.elasticsearch.index: "packetbeat-%{+yyyy.MM}"
  setup.template.name: "packetbeat"
  setup.template.pattern: "packetbeat-*"

However, when I am starting packetbeat - it creates index daily as follow:
green open packetbeat-6.6.1-2019.02.27

Any idea what am I doing wrong?

[andrewkroh]

It looks like your setup.template.* options are in the wrong place. Here's an example:

  setup.template:
    name:    'packetbeat-%{[beat.version]}'
    pattern: 'packetbeat-%{[beat.version]}-*'
    settings:
      index.number_of_shards: 3
      index.number_of_replicas: 1
      index.codec: best_compression

  output.elasticsearch:
    hosts:
      - '{{ es_url }}'
    username: '{{ beat_username }}'
    password: '{{ beat_password }}'
    index: 'packetbeat-%{[beat.version]}-%{+yyyy.MM}'

[derekmizak (DerekM)]

Andrew,

Thanks, it works.